Emergency event virtual network function deployment and configuration

ABSTRACT

A method, computer-readable medium, and device for deploying virtual network functions in response to detecting an emergency event are disclosed. A method may detect an emergency event associated with a first location, deploy a first virtual network function on a first host device of the wireless network in a central zone associated with the first location, in response to detecting the emergency event, and configure a first alarm threshold for the first virtual network function that is indicative of a type loading condition at the first virtual network function. The method may further deploy a second virtual network function on a second host device of the wireless network in a second zone and configure a second alarm threshold for the second virtual network function that is indicative of the type of loading condition at the second virtual network function.

This application is a continuation of U.S. patent application Ser. No.15/894,728, filed Feb. 12, 2018, now U.S. Pat. No. 10,366,597, which isa continuation of U.S. patent application Ser. No. 15/167,330, filed May27, 2016, now U.S. Pat. No. 9,892,622, all of which are hereinincorporated by reference in their entirety.

The present disclosure relates generally to methods, computer-readablemedia and devices for deploying virtual network functions in response todetecting emergency events.

BACKGROUND

Upgrading a telecommunication network to a software defined network(SDN) architecture implies replacing or augmenting existing networkelements that may be integrated to perform a single function with newnetwork elements. The replacement technology may comprise a substrate ofnetworking capability, often called network function virtualizationinfrastructure (NFVI) that is capable of being directed with softwareand SDN protocols to perform a broad variety of network functions andservices. Different locations in the telecommunication network may beprovisioned with appropriate amounts of network substrate, and to theextent possible, routers, switches, edge caches, middle-boxes, and thelike may be instantiated from the common resource pool.

SUMMARY

In one example, the present disclosure discloses a method,computer-readable medium, and device for deploying virtual networkfunctions in response to detecting an emergency event by a processor.For example, the processor may detect an emergency event associated witha first location, deploy first virtual network function on a first hostdevice of the wireless network in a central zone associated with thefirst location, in response to detecting the emergency event, andconfigure a first alarm threshold for the first virtual network functionthat is indicative of a type loading condition at the first virtualnetwork function. The processor may further deploy a second virtualnetwork function on a second host device of the wireless network in asecond zone, in response to detecting the emergency event, and configurea second alarm threshold for the second virtual network function that isindicative of the type of loading condition at the second virtualnetwork function. In one example, the first alarm threshold is less thanthe second alarm threshold.

BRIEF DESCRIPTION OF THE DRAWINGS

The teachings of the present disclosure can be readily understood byconsidering the following detailed description in conjunction with theaccompanying drawings, in which:

FIG. 1 illustrates an example system related to the present disclosure;

FIG. 2 illustrates an additional example system related to the presentdisclosure;

FIG. 3 illustrates a flowchart of an example method for deployingvirtual network functions in response to detecting an emergency event,according to the present disclosure; and

FIG. 4 illustrates a high-level block diagram of a computing devicespecially configured to perform the functions, methods, operations andalgorithms described herein.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe figures.

DETAILED DESCRIPTION

The present disclosure broadly discloses methods, computer-readablemedia and apparatuses for deploying virtual network functions inresponse to detecting emergency events. During normal conditions, awireless network may be capable of sustaining typical traffic withoutany issues. However, during emergency events, such as during naturaldisasters, severe weather events, public health or epidemiologicalevents, and the like, the traffic may surge exponentially. The wirelessnetwork may become overloaded and no longer able to sustain the traffic.In one example, a software defined network (SDN) architecture may enablea wireless network to scale up or down in the face of changing trafficdemands by adding and removing virtual network functions (VNFs), e.g.,virtual machines. However, when a VNF becomes congested in a rapidmanner and reaches an overload condition, the VNF may already be in a“drowning” state, where the VNF may be so overloaded that it is unableto respond to status requests or to send alerts to other networkcomponents, such as other VNFs, hypervisors and/or host devices, a SDNcontroller, non-NFVI devices in the network, and so forth. As such, anoverloaded VNF may not be able to perform its network function e.g., amobility management entity (MME), a Diameter routing agent (DRA), a homesubscriber server (HSS), a serving gateway (SGW), a packet data networkgateway (PGW), etc., to inform a hypervisor to reassign additionalresources to the VNF, to terminate or handoff traffic to other VNFs, orto inform upstream devices to reduce traffic to the VNF via ratelimiting, throttling, etc.

In accordance with the present disclosure a cellular/wireless networkmay include software defined network (SDN) components, or virtualnetwork functions (VNFs), and may deploy and configure VNFs in responseto emergency events, e.g., natural disasters, including geophysicalevents, such as a landslide, earthquake, or levee breach, meteorologicalevents, such as windstorms, tornadoes, hurricanes, tsunamis, lightningstorms, thunderstorms, hurricanes, freezing rain, blizzards, fog, etc.,public health events, such as chemical, biological, radiological,nuclear or explosive (CBRNE) threat or attack, or the like, andepidemiological events, such as disease outbreaks, spread of diseases,and so forth. In one example, a SDN controller or application serverdeployed in the wireless network may detect an emergency event. In oneexample, the detection may include receiving an alert from a responsibleagency, such as National Oceanic and Atmospheric Administration (NOAA),Centers for Disease Control and Prevention (CDC), other federal, state,or local agencies, or an international organization. In another example,the detection may be based upon a sensor network that may be part of thewireless network or controlled by the wireless network. Alternatively,or in addition, a sensor network may feed various measurements to thewireless network or may send alerts to the wireless network. Forinstance, a plurality of seismologic sensors may be deployed throughouta region and may detect earthquakes and tremors. Similarly, a pluralityof anemometers may be deployed to gather wind measurements, which may beused to detect a storm front, a path of a tornado, and so forth.

In one example, the emergency event may be detected with respect to alocation. For instance, a sensor network may have sensors deployed inknown locations. Thus, for example, if there is a tornado, one or moreanemometers may have readings above a threshold that is indicative of atornado, e.g., wind speeds greater than 70 miles per hour, greater than100 miles per hour, etc. In one example, a location may comprise acentral locus of an event. For instance, if ten anemometers havereadings above 100 miles per hour that may be indicative of a tornado,the location of the tornado may comprise a geographic center of thevarious sensors. In response to detecting an emergency event withrespect to a location, the present disclosure may deploy a number ofVNFs in anticipation of network impacts of the emergency event that isdetected.

In one example, the type of VNFs may be selected based upon the type ofemergency event, in addition to selecting the location(s) to deploy theVNFs. The locations of the VNFs may be selected to be within or near thelocation in which the public emergency is detected. For example, as atornado passes, based upon a “signature” or historical informationregarding past tornado events, it may be known that a large number ofphone calls may be generated to and from mobile endpoint devices thatare within the path of the tornado and/or nearby. In addition, it may beknown or anticipated that attempts to place outgoing calls may peakimmediately after the tornado has passed, when people within the path ofthe tornado may attempt to place calls to inform of their conditions,such as to indicate that they are fine, or to request medicalassistance. Thus, in one example, when a tornado is first detected bythe wireless network, the wireless network may deploy additional VNFs ator near the location at which the tornado was detected, e.g., in one ormore data center(s) having network function virtualizationinfrastructure (NFVI)/host devices closest to the tornado location.

In one example, additional zones surrounding the location may be definedby the wireless network in which additional VNFs may be deployed. Forinstance, the zones may be defined concentrically around the location inwhich the emergency event is first detected. In one example, a firstzone may comprise a central zone, or region, in which the number ofadditional VNFs is most concentrated. In one example, the central zoneincludes the location in which the emergency event is first detected. Inone example, a second zone surrounding the central zone may be defined,and additional VNFs may also be deployed in the second zone. However,the number of additional VNFs that are deployed in the second zone mayhave a lesser concentration than the number of VNFs in the central zone,e.g., less VNFs per registered mobile endpoint device, less VNFs persquare mile of coverage area, etc. Additional VNFs may be deployed in athird zone, albeit with a lesser concentration than the second zone, andso forth. Thus, there may be a “gradation” of additional VNFs deployedin the network, moving from a central zone, centered on a location inwhich the public emergency is detected, to subsequent zones movingoutward from the center.

In one example, zones may be defined concentrically around a location.However, in other examples, zones may be defined differently. Forinstance, if an emergency event is detected near a costal location,concentric zones may include areas that are over water. Therefore,asymmetrical zones, or irregular shaped zones, may be more appropriate.In addition, demographic information may indicate that the networkimpacts will not be balanced around a central zone. For example, suburbsof a particular city may be concentrated to the west of the city center,while there may be mountains to the east of the city center with farfewer people. Thus, asymmetrical zones may also be appropriate aroundsuch a location. In one example, a zone generating method may utilizemobile endpoint device registration information to determine a number ofmobile endpoint devices within an area.

In one example, alarm thresholds for overloading conditions may also beset differently for VNFs in the different zones surrounding the locationwhere the emergency event is detected. For example, during an emergencyevent, the network traffic may surge exponentially, overloading thenetwork such that it is no longer able to sustain the traffic. Inaddition, when a VNF becomes congested and reaches overload condition,the VNF may be in the drowning state, i.e., it may be so overloaded thatit is unable to respond and/or alert other VNFs and other networkinfrastructures. The VNF may also not be able to properly terminate andhandover to other VNFs, or to inform an upstream VNF or other networkdevice to reduce traffic volume via rate limiting and/or throttling,etc. As such, a lesser alarm threshold may be set for VNFs that are inthe central zone or in zones closer to the central zone. For instance,an alarm threshold may be set at 50 percent capacity for VNFs in thecentral zone, while an alarm threshold of 70 percent may be set for VNFsof a same or a similar type in the second zone. Thus, there may be a“gradation” of alarm thresholds moving from a central zone, centered ona location in which the emergency event is detected, to subsequent zonesmoving outward from the center. It should be noted that different typesof VNFs in a same zone may have different alarm thresholds. Forinstance, a virtual MME (vMME) may have a different alarm threshold, orset of alarm thresholds, than a virtual SGW (vSGW).

In one example, when an alarm is generated in a zone, the alarmthreshold(s) implemented in VNFs in the next zone moving outward may beadjusted downward, and so on, zone-by-zone. For instance, if an alarm isgenerated by a VNF in the central zone, the alarm may be propagated tothe VNFs or non-NFVI devices in the next zone, and/or to a SDNcontroller. In response, the alarm threshold(s) for the VNFs in the nextzone may be changed from 70 percent to 50 percent, for example. In thisway, as the network impacts of the emergency event may spreadgeographically, the network impacts may be anticipated and accounted forbefore different regions of the network are actually overloaded. Inaddition, in one example other network elements may adjust variousparameters in response to receiving a notification of the alarmcondition at the VNF that is reporting. For instance, if a VNF hasreached an alarm threshold, other upstream network elements (includingboth VNFs and non-NFVI components that send traffic to the VNF) mayimplement rate limiting to send less traffic to the VNF, to slow therate of sending, etc. For example, the upstream network element(s) mayselect a sending rate to correspond to a current alarm threshold for theVNF. For instance, if a VNF reaches an alarm threshold and the alarmthreshold is adjusted downward, the new alarm threshold may becommunicated to the upstream network element(s) which may then select anappropriate sending rate based upon the new alarm threshold.

In one example, the number of VNFs in a zone may also be increased if analarm is generated in a central zone and/or in a zone that is closer tothe central zone. In addition, the zones may be adjusted from time totime based on various factors. For instance, the central zone may bemoved as a tornado moves through a region, and the subsequent zones maybe adjusted accordingly. In one example, the shifting of the centralregion may be based upon relevant measurements, such as wind speedmeasurements that may detect the movement of a storm front or thecurrent location of a tornado. In another example, the changing locationof the emergency event may be provided via a data feed from a relevantagency. For instance, a data feed from NOAA may explicitly define acurrent geographic location/area of a thunderstorm. In addition, thegeographic location may be updated on a regular basis via subsequentmessages in the data feed. Once the central zone is adjusted, thedeployment of additional VNFs and the provisioning of alarm thresholdsmay be revised for the new central zone and the zones surrounding thecentral zone in a similar manner as described above. These and otheraspects of the present disclosure are discussed in greater detail belowin connection with the examples of FIGS. 1-4.

To better understand the present disclosure, FIG. 1 illustrates anexample network, or system 100 in which embodiments of the presentdisclosure for deploying virtual network functions in response todetecting an emergency event may operate. In one example, the system 100comprises a Long Term Evolution (LTE) network 101, an IP network 113,and a core network, e.g., an IP Multimedia Subsystem (IMS) core network115. In one example, system 100 is provided and operated by acellular/wireless network operator. FIG. 1 also illustrates variousmobile endpoint devices 116 and 117, e.g., LTE user equipment or userendpoints (UE). The mobile endpoint devices UE 116 and 117 may eachcomprise a cellular telephone, a smartphone, a tablet computing device,a laptop computer, a pair of computing glasses, a wireless enabledwristwatch, or any other cellular-capable mobile telephony and computingdevice (broadly, “mobile endpoint devices”).

In one example, the LTE network 101 comprises an access network 103 anda core network, Evolved Packet Core (EPC) network 105. In one example,the access network 103 comprises an evolved Universal Terrestrial RadioAccess Network (eUTRAN). The eUTRANs are the air interfaces of the 3rdGeneration Partnership Project (3GPP) LTE specifications for mobilenetworks. In one example, EPC network 105 provides various functionsthat support wireless services in the LTE environment. In one example,EPC network 105 is an Internet Protocol (IP) packet core network thatsupports both real-time and non-real-time service delivery across a LTEnetwork, e.g., as specified by the 3GPP standards. In one example, alleNodeBs in the access network 103 are in communication with the EPCnetwork 105. In operation, mobile endpoint device 116 may accesswireless services via the eNodeB 111 and mobile endpoint device 117 mayaccess wireless services via the eNodeB 112 located in the accessnetwork 103. It should be noted that any number of eNodeBs can bedeployed in an eUTRAN. In one illustrative example, the access network103 may comprise one or more eNodeBs.

In EPC network 105, network devices such as Mobility Management Entity(MME) 107 and Serving Gateway (SGW) 108 support various functions aspart of the LTE network 101. For example, MME 107 is the control nodefor the LTE access network. In one embodiment, MME 107 is responsiblefor UE (User Equipment) tracking and paging (e.g., such asretransmissions), bearer activation and deactivation process, selectionof the SGW, and authentication of a user. In one embodiment, SGW 108routes and forwards user data packets, while also acting as the mobilityanchor for the user plane during inter-eNodeB handovers and as theanchor for mobility between LTE and other wireless technologies, such as2G and 3G wireless networks.

In addition, EPC network 105 may comprise a Home Subscriber Server (HSS)109 that contains subscription-related information (e.g., subscriberprofiles), performs authentication and authorization of a wirelessservice user, and provides information about the subscriber's location.The EPC network 105 may also comprise a public data network (PDN)gateway 110 which serves as a gateway that provides access between theEPC network 105 and various data networks, e.g., other IP networks 113,an IMS core network 115, and the like. The public data network gatewayis also referred to as a PDN gateway, a PDN GW or a PGW. In addition,the EPC network 105 may include a Diameter routing agent (DRA) 106,which may be engaged in the proper routing of messages between otherelements within EPC network 105, and with other components of the system100, such as a call session control function (CSCF) in IMS core network115.

In accordance with the present disclosure, any one or more of thecomponents of EPC network 105 may comprise network functionvirtualization infrastructure (NFVI), e.g., SDN host devices (i.e.,physical devices) configured to operate as various virtual networkfunctions (VNFs), such as a virtual MME (vMME), a virtual HHS (vHSS), avirtual serving gateway (vSGW), a virtual packet data network gateway(vPGW), and so forth. For instance, MME 107 may comprise a vMME, SGW 108may comprise a vSGW, and so forth. In this regard, the EPC network 105may be expanded (or contracted) to include more or less components thanthe state of EPC network 105 that is illustrated in FIG. 1. Forinstance, EPC network 105 may be expanded to include additional PDNgateways, e.g., in the form of vPGWs, additional serving gateways(SGWs), e.g., in the form of vSGWs, and so forth. In one example, theSDN host devices may be deployed in one or more geographically diversedata centers. Accordingly, in one example, the network may be segregatedinto a number of zones, where different VNFs may be deployed indifferent zones depending upon the respective locations of the one ormore data centers. The example of FIG. 2 illustrates this concept ingreater detail.

In one example, the EPC network 105 may also include an applicationserver (AS) 190. In one embodiment, AS 190 may comprise a computingsystem, such as computing system 400 depicted in FIG. 4, and may beconfigured to provide one or more functions for deploying virtualnetwork functions in response to detecting an emergency event, and forperforming various other operations in accordance with the presentdisclosure. For example, AS 190 may be configured to perform functionssuch as those described below in connection with the example method 300of FIG. 3. Accordingly, the AS 190 may be connected directly orindirectly to any one or more network elements of EPC network 105, andof the system 100 in general, that are configured to gather and forwardnetwork analytic information, such as signaling and traffic data, alarmdata, and other information and statistics to AS 190 and to receiveinstructions from AS 190.

In one example, AS 190 may comprise a SDN controller that is responsiblefor instantiating, configuring, managing, and releasing VNFs. Forexample, in a SDN architecture, a SDN controller may instantiate virtualnetwork functions (VNFs) on shared hardware, which may be referred to asnetwork function virtualization infrastructure (NFVI), host devices, orSDN nodes, and which may be physically located in various places. Forexample SDN nodes may reside in various data centers distributed indifferent locations. For example, a router may be instantiated on a SDNnode, and released when the router is no longer needed. Similarly, amedia server may be instantiated on a SDN node, and released when nolonger needed. In one example, the configuring, releasing, andreconfiguring of SDN nodes is controlled by the SDN controller, whichmay store configuration code, e.g., computer/processor-executableprograms, instruction, code, or the like for various functions which canbe loaded onto an SDN node. In another example, the SDN controller mayinstruct, or request an SDN node to retrieve appropriate configurationcode from a network-based repository, e.g., a storage device, to relievethe SDN controller from having to store and transfer configuration codefor various functions to the SDN nodes. As used herein, the terms“configured” and “reconfigured,” and variations thereof, may refer toprogramming or loading a computing device withcomputer-readable/computer-executable instructions, code, and/orprograms, e.g., in a memory, which when executed by a processor of thecomputing device, may cause the computing device to perform variousfunctions.

In one example, AS 190 may be deployed in a network operations center(NOC) of a wireless network operator, e.g., an entity operating the EPCnetwork 105, LTE network 101, access network 103, and so on. Due to therelatively large number of connections available between AS 190 andother network elements, none of the actual links to the applicationserver are shown in FIG. 1. Similarly, links between DRA 106, MME 107,SGW 108, eNodeBs 111 and 112, PDN gateway 110, and other components ofsystem 100 are also omitted for clarity.

In one example, AS 190 may be configured to receive alerts from alertoriginator devices 175 deployed in networks 170, each of which may beassociated with an authorized alert originator. For example, one or moreof the alert originator devices 175 may comprise all or a portion of aFederal Emergency Management Administration (FEMA) Integrated PublicAlert and Warning System (IPAWS), a NOAA warning system, such as aNational Weather Service (NWS) alert server to provide watches,warnings, advisories, or the like in a Common Alerting Protocol (CAP)format, a CDC server for sending health alerts, and so forth. Each ofthe alerts may notify of an emergency event and provide a location ofthe emergency event. For instance, an alert may indicate that a tornadois detected and may provide a relevant location, e.g., with geographiccoordinates to identify the center of the tornado.

In one example, AS 190 may also receive sensor data from sensor(s) 179,which may be deployed in network(s) 170, or from sensor(s) 119, whichmay be connected to LTE network 101 via access network 103. Forinstance, in one example sensor(s) 119 may comprise wireless/cellularcommunication-enabled devices that are capable of measuring variousphysical parameters from an environment and reporting such measurementswirelessly via a cellular/wireless link. In one example, sensors 119 maybe managed by the EPC network 105 and/or LTE network 101, e.g., by AS190. In one example, sensor(s) 179 may be operated by the same entity,or entities, that control alert originator device(s) 175. Data fromsensor(s) 119 and/or sensor(s) 179 may be used to detect an emergencyevent, and to detect a location of such an emergency event by network(s)170 or by EPC network 105 and/or LTE network 101, e.g., by AS 190.

The foregoing description of the system 100 is provided as anillustrative example only. In other words, the example of system 100 ismerely illustrative of one network configuration that is suitable forimplementing embodiments of the present disclosure. As such, otherlogical and/or physical arrangements for the system 100 may beimplemented in accordance with the present disclosure. For example, AS190, and/or other network components may be deployed in an IMS corenetwork 115 instead of being deployed within the EPC network 105, or inother portions of system 100 that are not shown, while providingessentially the same functionality.

In addition, although aspects of the present disclosure have beendiscussed above in the context of a long term evolution (LTE)-basedwireless network, examples of the present disclosure are not so limited.Thus, the teachings of the present disclosure can be applied to othertypes of wireless networks (e.g., 2G network, 3G network and the like),for deploying virtual network functions in response to detecting anemergency event. Thus, these and other modifications are allcontemplated within the scope of the present disclosure.

FIG. 2 illustrates an additional example network, or system 200 in whichembodiments of the present disclosure for deploying virtual networkfunctions in response to detecting an emergency event may operate. Inone example, system 200 may represent at least a portion of acellular/wireless network. For instance, system 200 may representcertain SDN aspects of the network, or system 100 of FIG. 1. Asillustrated in FIG. 2, system 200 may include a software defined networkSDN controller 250, e.g., a server having at least a processor and acomputer-readable medium storing instructions which, when executed bythe processor, cause the processor to perform functions for deployingvirtual network functions in response to detecting an emergency event,and for performing various other operations in accordance with thepresent disclosure. In one embodiment, the SDN controller 250 maycorrespond to AS 190 of the example of FIG. 1. In one embodiment, theSDN controller 250 may comprise a computing system, such as computingsystem 400 depicted in FIG. 4. In one embodiment, the SDN controller 250may comprise a plurality of devices that may be co-located, or indistributed locations, and that perform coordinated functions of an SDNcontroller, as described herein.

As further illustrated in FIG. 2, the system 200 may include a number ofnetwork function virtualization infrastructure (NFVI) 201-219 deployedin an area, e.g., in a state, province, country, or other region. In oneexample, NFVI 201-219 may comprise servers in data centers or in otherlocations, and that are available as host devices, or “SDN hosts” tohost virtual machines comprising virtual network functions VNFs. Forexample, NFVI 201-219 may comprise shared hardware, e.g., one or morehost devices comprising line cards, central processing units (CPUs), orprocessors, memories to hold computer-readable/computer-executableinstructions, code, and/or programs, and so forth. In accordance withthe present disclosure, the VNFs may comprise wireless networkcomponents, such as LTE components of a MME, a HSS, a DRA, a SGW, a PGW,and so forth, and/or routers, switches, and other devices to supportadditional traffic related to such components. For ease of illustration,additional components of the system 200 may be omitted from FIG. 2, suchas base stations or eNodeBs, and non-NFVI components, such as a“non-virtual” HSS, MME, SGW, PGW, or DRA, the physical links betweensuch components, and so on.

In one example, SDN controller 250 may provision and releaseinstantiations of VNFs, configure alarms, security parameters, routingtables, and other operating parameters for the VNFs. In one example, SDNcontroller 250 may maintain communications with VNFs and/or hostdevices/NFVI 201-219 via a number of control links (not shown). Controllinks may comprise secure tunnels for signaling communications over anunderling IP infrastructure of the system 200. In other words, controllinks may comprise virtual links multiplexed with transmission trafficand other data traversing system 200 and carried over a shared set ofphysical links. In one example, the SDN controller 120 may also comprisea virtual machine operating on NFVI/host device(s), or may comprise adedicated device. For instance, controller 250 may be collocated withone or more VNFs, or may be deployed in a different host device or at adifferent physical location.

In one example, SDN controller 250 may detect an emergency event at afirst location 291. For instance, SDN controller 250 may receive sensorreadings from a plurality of sensors (not shown) which are indicative ofthe emergency event at the first location 291. In another example, SDNcontroller 250 may detect the emergency event at the first location 291by receiving an alert from a responsible federal, state, or localagency, from an international organization, and so forth.

In one example, the SDN controller 250 may then predict network impactsfrom the emergency event and define a number of zones 220, 230, and 240around the first location 291. In the example of FIG. 2, the zones 220,230, and 240 may be defined concentrically around the first location 291in which the emergency event is first detected. However, in otherexamples, zones may be defined differently. For instance, if anemergency event is detected near a costal location, concentric zones mayinclude areas that are over water. Therefore, asymmetrical zones and/orirregular-shaped zones may be more appropriate. In addition, demographicinformation may indicate that the network impacts will not be balancedaround a central zone. For example, suburbs of a particular city may beconcentrated to the west of the city center, while there may bemountains to the east of the city center with far fewer people. Thus,asymmetrical zones and/or irregular-shaped zones may also be appropriatearound such a location. In one example, a zone generating algorithm mayutilize mobile endpoint device registration information to determine anumber of mobile endpoint devices within an area, which may then beutilized to defined zone boundaries in an asymmetrical manner.

In the example of FIG. 2, central zone 220 includes the location 291 inwhich the emergency event is first detected. In one example, SDNcontroller 250 may deploy VNFs such that the number of additional VNFsis most concentrated in the central zone 220 as compared to the secondzone 230, the third zone 240, etc. For instance, the number ofadditional VNFs that are deployed in the second zone 230 may have alesser concentration than the number of VNFs in the central zone 220,e.g., less VNFs per registered mobile endpoint device, less VNFs persquare mile of coverage area, etc. Additional VNFs may be deployed inthe third zone 240, albeit with a lesser concentration than the secondzone 230, and so forth. Thus, there may be a “gradation” of additionalVNFs deployed in the system 200, moving from the central zone 220 tosubsequent zones moving outward from the first location 291. Toillustrate, SDN controller 250 may deploy an additional vMME, twoadditional vSGWs, an additional vDRA, and an additional vPGW in NFVI201, and an additional vSGW, an additional vHSS, and two additionalvPGWs in NFVI 202, located in the central zone 220. SDN controller 250may also deploy an additional vSGW and vPGW in NFVI 207, and anadditional vSGW and vPGW in NFVI 204, located in the second zone 230.Notably, the second zone 230 has more NFVI available, e.g., NFVI 203,205, 206, and 208. However, because the network impacts of the emergencyevent may be less certain and less immediate for the second zone 230,less additional VNFs may be deployed and may be more sparsely dispersedover available NFVI within the second zone 230 as compared to thecentral zone 220. In addition, in one example, at least one additionalVNF may be deployed in the third zone 240, such as an additional vSGW onNFVI 216.

In one example, SDN controller 250 may further configure alarmthresholds for VNFs that are added in response to the detection of theemergency event. In one example, the SDN controller 250 may also adjustalarm thresholds of any additional VNFs already deployed in the centralzone 220 or any other zone prior to the detection of the emergencyevent. The alarm thresholds may relate to various factors that may beindicative of overloading conditions, such as an excessive volume oftraffic being processed by the VNF. For instance, an alarm may relate toan excessive number of new call setup signaling messages, an excessivenumber of wireless channels or bearers that are occupied, and so forth.

In one example, lesser alarm threshold(s) may be set for VNFs that arein the central zone 220 or in zones closer to the central zone. Forinstance, an alarm threshold may be set at 50 percent capacity for VNFsof a particular type in the central zone 220, while an alarm thresholdof 70 percent may be set for VNFs (e.g., of a same or a similar type) inthe second zone 230. Thus, there may be a “gradation” of alarmthresholds moving from the central zone 220 to subsequent zones movingoutward from the center. It should be noted that different types of VNFsin a same zone may have different alarm thresholds. For instance, avirtual MME (vMME) may have a different alarm threshold, or set of alarmthresholds, than a virtual SGW (vSGW), a vDRA may have different alarmthreshold(s) than a vHSS, and so on.

In one example, a VNF reaching an alarm threshold may send anotification of such a condition to the SDN controller 250 and/or toother VNFs and non-NFVI infrastructure (not shown) in the system 200. Inone example, the SDN controller 250 may reconfigure an alarm thresholdfor any one or more VNFs in a same zone as a VNF reaching an alarmthreshold and/or in any subsequent zones. For example, a VNF deployed onNFVI 201 in the central zone 220 may reach an alarm threshold, e.g., analarm threshold of 50 percent capacity, and may notify SDN controller250. In response, SDN controller 250 may then reduce alarm thresholdsfor VNFs deployed on NFVI 204 and 207 in the second zone 230 from 70percent to 50 percent, for instance. In another example, if a VNFdeployed on NFVI 204 in the second zone 230 reaches an alarm thresholdof 70 percent, for example, the SDN controller 250 may reduce the alarmthreshold for a VNF deployed on NFVI 204 in the same zone from 70percent to 50 percent (e.g., a VNF of a same or a similar type as theVNF generating the alarm notification). In addition, an alarm thresholdfor a VNF deployed on NFVI 216 in the third zone 240 may be reduced. Forinstance, if the VNF deployed in NFVI 216 has an alarm threshold of 80percent, the alarm threshold may be reduced to 70 percent, to 65percent, etc. In another example, VNFs may communicate alarmnotifications directly with one another. As such, in one example, a VNFmay determine to adjust its own alarm threshold in response to receivingan alarm notification from a peer VNF, rather than awaiting aninstruction from the SDN controller 250.

In one example, in response to receiving an alarm notification, SDNcontroller 250 may also deploy additional VNFs near the VNF/NFVI thatoriginated the alarm notification. For example, if a VNF of NFVI 207generates an alarm notification, SDN controller may determine to add anadditional VNF at NFVI 206, which may be in a next closest location ofavailable NFVI to NFVI 207 within the same zone (second zone 230). SDNcontroller 250 may also increase a number of VNFs in a next zone movingaway from the first location 291. For example, since a VNF at NFVI 207in the second zone 230 has already reached an alarm threshold, networkimpacts of the emergency event may now be considered more likely in thethird zone 240, warranting additional VNFs to be deployed in the thirdzone 240 in anticipation of such network impacts.

In one example, the SDN controller 250 may detect that the emergencyevent has moved from the first location 291 to a second location 292 andmay adjust the central zone 220 to position 225 to include the secondlocation 292. The SDN controller 250 may further adjust the second zone230 in response to the adjusting the central zone 220. For example, thesecond zone 230 may be moved to position 235. In this regard, SDNcontroller 250 may instantiate and/or release any number of VNFs fromNFVI 201-219 in response to the movement or spread of the emergencyevent to the second location 292. For example, SDN controller 250 mayarrange the deployments of VNFs in the system 200 such that the centralzone 220 at position 225 comprises a greater concentration of VNFs ascompared to the second zone 230 at position 235. In the present example,this may include deployments of two additional vPGWs in NFVI 215 and anadditional vDRA in NFVI 205 in the central zone 220 at position 225. TheSDN controller 250 may also instantiate an additional vSGW at NFVI 219in the second zone 230 at position 235. It should be noted that theposition of the third zone 240 may also be adjusted in response to thedetection of the movement of the emergency event to the second location292. However, for ease of illustration this particular aspect is omittedfrom the example of FIG. 2. It should also be noted that the alarmthresholds of respective VNFs may also be configured or reconfigureddepending upon the inclusions of VNFs/NFVI in different zones afterrepositioning in response to the movement of the emergency event to thesecond location 292.

FIG. 3 illustrates a flowchart of an example method 300 for deployingvirtual network functions in response to detecting an emergency event.In one embodiment, the steps, operations or functions of the method 300may be performed by any one or more of the components of the system 100depicted in FIG. 1 or the system 200 of FIG. 2. For example, in oneembodiment, the method 300 is performed by the application server (AS)190. In another embodiment, the method 200 is performed by AS 190 incoordination with other components of the system 100. In anotherexample, the method 300 is performed by SDN controller 250 of FIG. 2, orby SDN controller 250 in coordination with other components of thesystem 200. Alternatively, or in addition, one or more steps, operationsor functions of the method 300 may be implemented by a computing devicehaving a processor, a memory and input/output devices as illustratedbelow in FIG. 4, specifically programmed to perform the steps, functionsand/or operations of the method. Although any one of the elements insystem 100 of FIG. 1 or system 200 of FIG. 2 may be configured toperform various steps, operations or functions of the method 300, themethod will now be described in terms of an embodiment where steps ofthe method are performed by a processor, such as processor 402 in FIG.4. For example, processor 402 may be deployed in a wireless network toperform the method 300.

The method 300 begins in step 305 and proceeds to step 310. In step 310,the processor detects an emergency event associated with a firstlocation. In one example, the emergency event and the first location maybe detected via an alert from a responsible federal, state, or localagency, from an international organization, and so forth. In anotherexample, the emergency event and the first location may be detected viaa plurality of sensors that may be part of the wireless network orcontrolled by the wireless network. Alternatively, or in addition, asensor network may feed various measurements to the processor in thewireless network or may send alerts to the processor that are indicativeof the emergency event and its location.

At step 315, the processor deploys at least a first virtual networkfunction (VNF) on a first host device of the wireless network in acentral zone associated with the first location, in response todetecting the emergency event. In one example, the processor maydetermine a plurality of zones surrounding the first location, where theplurality of zones may comprise a central zone that includes the firstlocation, and at least a second zone. In one example, the second zonemay surround the first zone. In one example, a third zone and subsequentzones may also be defined. In one example, the zones may be concentricaround the first location and cover a geographic area, such as a county,a state, a province, a country, or other region. In another example, thezones may be asymmetrically defined and/or comprise irregular shapes.For instance, the central zone, the second zone, and any subsequentzones may be defined based upon a distribution of mobile endpoint deviceregistrations with the wireless network. In another example, the zonesmay be defined based upon historical network traffic patterns in thewireless network for a region that includes the first location. Forexample, the historical network traffic patterns may relate to at leastone previous emergency event of a same type as the current emergencyevent. Alternatively, or in addition, the zones may be asymmetricaland/or irregularly defined based upon geographic factors, such asoceans, mountains, swamps, etc., based upon census informationindicative of general populations of various areas, and so forth. Forinstance, the processor may have access to a geographic informationsystem (GIS) with such information in an electronic format that can becross-referenced to the first location in which the emergency event isdetected.

At least a first VNF that is deployed in the central zone may functionas any one or more wireless network components, such as a HSS, a MME, aSGW, a PGW, a DRA, routers and other infrastructure comprising linksbetween such components, and so forth. In one example, the selection ofthe type(s) of VNFs may be based upon the type of emergency event.

At step 320, the processor configures a first alarm threshold for thefirst VNF that is indicative of a type of loading condition at the firstVNF. For example, one of the functions of a DRA is to route signalingmessages from mobile endpoint devices via a MME to a HSS. Thus, an alarmthreshold at the DRA may comprise a threshold number of signalingmessages received on an incoming interface from an MME, a number ofsignaling messages on an outgoing interface to the HSS, and so on. Ingeneral, different types of alarm thresholds, and different values forsuch alarm thresholds may be selected based upon the type of VNF.

At step 325, the processor deploys at least a second VNF on a secondhost device of the wireless network in a second zone, in response todetecting the emergency event. The second zone may be defined withrespect to the central zone as described above. The at least a secondVNF may comprise the same or different type of VNF, or VNFs, as the atleast a first VNF deployed in the central zone. In one example, the atleast a first VNF may comprise a first plurality of VNFs, and at least asecond VNF may comprise a second plurality of VNFs. In addition, in oneexample, the first plurality of VNFs may be deployed with a greaterconcentration of VNFs in the central zone as compared to a concentrationof the second plurality of VNFs that are deployed in the second zone. Inone example, a concentration of the first plurality of VNFs and aconcentration of the second plurality of VNFs are calculated based uponhistorical network traffic patterns in the wireless network for a regionthat includes the first location and relating to at least one previousemergency event of a same type as the current emergency event.

At step 330, the processor configures a second alarm threshold for thesecond VNF that is indicative of the type of loading condition at thesecond VNF. For instance, in one example, the first VNF and the secondVNF may be a same type of VNF. However, because the first VNF is withinthe central zone, it may be the case that there is a greater likelihoodthat the first VNF may become quickly overloaded and enter a “drowning”state. As such, in one example, the alarm threshold for the first VNFmay be less than the alarm threshold for the second VNF. For instance,the alarm threshold for the first VNF may be 50 percent of a maximumnumber of signaling messages to be processed in a given time, while thealarm threshold for the second VNF may be 70 percent of a maximum numberof signaling messages to be processed in the given time.

At optional step 335, the processor may deploy at least a third VNF on athird host device of the wireless network in a third zone, in responseto detecting the emergency event. In one example, the second VNF and thethird VNF may include VNFs of a same type. In one example, the number ofadditional VNFs that are deployed in the third zone may have a lesserconcentration than the number of VNFs in the second zone. Thus, theremay be a “gradation” of additional VNFs deployed in the wirelessnetwork, moving from the central zone to the second zone, the thirdzone, and so on.

At optional step 340, the processor may configure a third alarmthreshold for the third VNF that is indicative of the type of loadingcondition at the third VNF. In one example, the third alarm threshold isless than the second alarm threshold. For instance, the second VNF andthe third VNF may be a same type of VNF, and the second alarm thresholdand the third alarm threshold may relate to a same type of loadingcondition. Thus, there may be a “gradation” of alarm thresholds movingfrom the central zone to the second zone, the third zone, and so on.

At optional step 345, the processor may receive an alarm notificationfrom the at least a first VNF, triggered by the first alarm thresholdbeing reached. For instance, the at least a first VNF may detect thatthe first alarm threshold is reached, and may send an alarm notificationto the processor and/or to other VNFs and non-NFVI components within thewireless network.

At optional step 350, the processor may reconfigure the second alarmthreshold for the second VNF to a lesser value and/or deploy at least athird VNF in the wireless network in the second zone, in response toreceiving the alarm notification. For instance, when an alarm isgenerated in a zone, the alarm threshold(s) implemented in VNFs in thenext zone moving outward may be adjusted downward, and so on,zone-by-zone. For instance, the second alarm threshold for the secondVNF may be changed from 70 percent to 50 percent, from 65 percent to 55percent, etc. Likewise, the number of VNFs in a zone may also beincreased if an alarm is generated in a central zone and/or in a zonethat is closer to the central zone. In this way, as the network impactsof the emergency event may spread geographically, the network impactsmay be anticipated and accounted for before different regions of thenetwork are actually overloaded.

At optional step 355, the processor may detect that the emergency eventhas moved from the first location to a second location. For example, asa tornado moves through a region, the processor may detect that thecurrent location of the tornado has changed from the first location tothe second location. In one example, the movement of the emergency eventfrom the first location to the second location may be detected basedupon updated measurements from a plurality of sensors, such as windspeed measurements indicative of the current location of a tornado. Inanother example, the changing location of the emergency event may beprovided via a data feed and/or an update message from a relevantagency. For instance, a data feed from NOAA may comprise a series ofupdate messages that explicitly define a current geographiclocation/area of a thunderstorm, where the geographic location may beupdated on a regular basis.

At optional step 360, the processor may adjust the central zone toinclude the second location. For instance, the central zone may be movedfrom being centered on the first location to being centered on thesecond location. In one example, the adjusting may include maintaining alarger concentration of additional VNFs in the central zone after thecentral zone is moved. For instance, this may include the deployment ofadditional VNFs within the central zone after the move.

At optional step 365, the processor may adjust the second zone inresponse to the adjusting the central zone. For instance, once thecentral zone is adjusted, the deployment of additional VNFs and theprovisioning of alarm thresholds may be revised for the new centralzone, and the zones surrounding the central zone, in a similar manner asdescribed above. For example, between optional steps 360 and 365, theprocessor may arrange the wireless network such that after adjusting thecentral zone and the second zone, the central zone comprises a greaterconcentration of VNFs as compared to the second zone. In one example,additional adjustments may be made to a third and any subsequent zonesin a similar manner.

Following step 330, or following any of optional steps 335-365, themethod 300 may proceed to step 395 where the method ends.

In addition, although not specifically specified, one or more steps,functions, or operations of the method 300 may include a storing,displaying and/or outputting step as required for a particularapplication. In other words, any data, records, fields, and/orintermediate results discussed in the method 300 can be stored,displayed, and/or outputted either on the device executing therespective method or to another device, as required for a particularapplication. Furthermore, steps, blocks, functions, or operations inFIG. 3 that recite a determining operation or involve a decision do notnecessarily require that both branches of the determining operation bepracticed. In other words, one of the branches of the determiningoperation can be deemed as an optional step. Moreover, steps, blocks,functions, or operations of the above described method 300 can becombined, separated, omitted, and/or performed in a different order fromthat described above, without departing from the examples of the presentdisclosure.

FIG. 4 depicts a high-level block diagram of a computing devicespecifically programmed to perform the functions described herein. Asdepicted in FIG. 4, the system 400 comprises one or more hardwareprocessor elements 402 (e.g., a central processing unit (CPU), amicroprocessor, or a multi-core processor), a memory 404 (e.g., randomaccess memory (RAM) and/or read only memory (ROM)), a module 405 fordeploying virtual network functions in response to detecting anemergency event, and various input/output devices 406 (e.g., storagedevices, including but not limited to, a tape drive, a floppy drive, ahard disk drive or a compact disk drive, a receiver, a transmitter, aspeaker, a display, a speech synthesizer, an output port, an input portand a user input device (such as a keyboard, a keypad, a mouse, amicrophone and the like)). Although only one processor element is shown,it should be noted that the computing device may employ a plurality ofprocessor elements. Furthermore, although only one computing device isshown in the figure, if the method 300 as discussed above is implementedin a distributed or parallel manner for a particular illustrativeexample, i.e., certain steps of the above method 300, or the entiremethod 300 is implemented across multiple or parallel computing devices,then the computing device of this figure is intended to represent eachof those multiple computing devices.

Furthermore, one or more hardware processors can be utilized insupporting a virtualized or shared computing environment. Thevirtualized computing environment may support one or more virtualmachines representing computers, servers, or other computing devices. Insuch virtualized virtual machines, hardware components such as hardwareprocessors and computer-readable storage devices may be virtualized orlogically represented.

It should be noted that the present disclosure can be implemented insoftware and/or in a combination of software and hardware, e.g., usingapplication specific integrated circuits (ASIC), a programmable gatearray (PGA) including a Field PGA, or a state machine deployed on ahardware device, a computing device or any other hardware equivalents,e.g., computer readable instructions pertaining to the method discussedabove can be used to configure a hardware processor to perform thesteps, functions and/or operations of the above disclosed method 300. Inone embodiment, instructions and data for the present module or process405 for deploying virtual network functions in response to detecting anemergency event (e.g., a software program comprising computer-executableinstructions) can be loaded into memory 404 and executed by hardwareprocessor element 402 to implement the steps, functions or operations asdiscussed above in connection with the illustrative method 300.Furthermore, when a hardware processor executes instructions to perform“operations,” this could include the hardware processor performing theoperations directly and/or facilitating, directing, or cooperating withanother hardware device or component (e.g., a co-processor and the like)to perform the operations.

The processor executing the computer readable or software instructionsrelating to the above described method can be perceived as a programmedprocessor or a specialized processor. As such, the present module 405for deploying virtual network functions in response to detecting anemergency event (including associated data structures) of the presentdisclosure can be stored on a tangible or physical (broadlynon-transitory) computer-readable storage device or medium, e.g.,volatile memory, non-volatile memory, ROM memory, RAM memory, magneticor optical drive, device or diskette and the like. Furthermore, a“tangible” computer-readable storage device or medium comprises aphysical device, a hardware device, or a device that is discernible bythe touch. More specifically, the computer-readable storage device maycomprise any physical devices that provide the ability to storeinformation such as data and/or instructions to be accessed by aprocessor or a computing device such as a computer or an applicationserver.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example only, and nota limitation. Thus, the breadth and scope of a preferred embodimentshould not be limited by any of the above-described example embodiments,but should be defined only in accordance with the following claims andtheir equivalents.

What is claimed is:
 1. A method comprising: detecting, by a processor ofa wireless network, an emergency event associated with a first location;deploying, by the processor, a first virtual network function on a firsthost device of the wireless network in a first zone associated with thefirst location, in response to the detecting the emergency event,wherein the first zone comprises an irregular shaped zone; configuring,by the processor, a first alarm threshold for the first virtual networkfunction that is indicative of a type of loading condition at the firstvirtual network function; deploying, by the processor, a second virtualnetwork function on a second host device of the wireless network in asecond zone, in response to the detecting the emergency event; andconfiguring, by the processor, a second alarm threshold for the secondvirtual network function that is indicative of the type of loadingcondition at the second virtual network function, wherein the firstalarm threshold is less than the second alarm threshold.
 2. The methodof claim 1, wherein the emergency event is detected via an alert from adevice of a responsible agency.
 3. The method of claim 1, wherein theemergency event comprises: a natural disaster; a weather event; or anepidemiological event.
 4. The method of claim 1, wherein the firstvirtual network function comprises one of a first plurality of virtualnetwork functions that is deployed in the first zone, wherein the secondvirtual network function comprises one of a second plurality of virtualnetwork functions that is deployed in the second zone, wherein the firstplurality of virtual network functions is deployed with a greaterconcentration of virtual network functions in the first zone as comparedto a concentration of the second plurality of virtual network functionsthat is deployed in the second zone.
 5. The method of claim 4, whereinthe emergency event comprises a current emergency event, wherein aconcentration of the first plurality of virtual network functions andthe concentration of the second plurality of network functions arecalculated based upon historical network traffic patterns in thewireless network for a region that includes the first location for atleast one previous emergency event of a same type as the currentemergency event.
 6. The method of claim 1, wherein the emergency eventcomprises a current emergency event, wherein the first zone and thesecond zone are determined based upon historical network trafficpatterns in the wireless network for a region that includes the firstlocation for at least one previous emergency event of a same type as thecurrent emergency event.
 7. The method of claim 1, wherein the firstzone and the second zone are determined based upon a distribution ofmobile endpoint device registrations with the wireless network.
 8. Themethod of claim 1, wherein the first zone includes the first location,and wherein the second zone surrounds the first zone.
 9. The method ofclaim 1, further comprising: deploying, by the processor, a thirdvirtual network function on a third host device of the wireless networkin a third zone, in response to the detecting the emergency event; andconfiguring, by the processor, a third alarm threshold for the thirdvirtual network function that is indicative of the type of loadingcondition at the third virtual network function, wherein the secondalarm threshold is less than the third alarm threshold.
 10. The methodof claim 9, wherein the third virtual network function comprises one ofa third plurality of virtual network functions that is deployed in thethird zone.
 11. The method of claim 1, further comprising: receiving analarm notification from the first virtual network function, wherein thealarm notification is triggered by the first alarm threshold beingreached; and reconfiguring the second alarm threshold for the secondvirtual network function to a lesser value.
 12. The method of claim 1,further comprising: receiving an alarm notification from the firstvirtual network function, wherein the alarm notification is triggered bythe first alarm threshold being reached; and deploying at least a thirdvirtual network function in the wireless network in the second zone, inresponse to the receiving the alarm notification.
 13. The method ofclaim 1, wherein the processor comprises a processor of a softwaredefined network controller.
 14. The method of claim 1, furthercomprising: detecting that the emergency event has moved from the firstlocation to a second location; adjusting the first zone to include thesecond location; and adjusting the second zone in response to theadjusting the first zone, wherein the first zone comprises a greaterconcentration of virtual network functions as compared to the secondzone, after the adjusting the first zone to include the second locationand the adjusting the second zone in response to the adjusting the firstzone.
 15. The method of claim 14, wherein the emergency event isdetected via an alert from a device of a responsible agency, wherein thedetecting that the emergency event has moved from the first location tothe second location comprises receiving an update message from theresponsible agency.
 16. The method of claim 1, wherein each of the firstvirtual network function and the second virtual network functioncomprises one of: a mobility management entity; a diameter routingagent; a home subscriber server; a packet data network gateway; or aserving gateway.
 17. A non-transitory computer-readable medium storinginstructions which, when executed by a processor of a wireless network,cause the processor to perform operations, the operations comprising:detecting an emergency event associated with a first location; deployinga first virtual network function on a first host device of the wirelessnetwork in a first zone associated with the first location, in responseto the detecting the emergency event, wherein the first zone comprisesan irregular shaped zone; configuring a first alarm threshold for thefirst virtual network function that is indicative of a type of loadingcondition at the first virtual network function; deploying a secondvirtual network function on a second host device of the wireless networkin a second zone, in response to the detecting the emergency event; andconfiguring a second alarm threshold for the second virtual networkfunction that is indicative of the type of loading condition at thesecond virtual network function, wherein the first alarm threshold isless than the second alarm threshold.
 18. The non-transitorycomputer-readable medium of claim 17, wherein the emergency event isdetected via an alert from a device of a responsible agency.
 19. Thenon-transitory computer-readable medium of claim 17, wherein theemergency event comprises: a natural disaster; a weather event; or anepidemiological event.
 20. A device comprising: a processor of awireless network; and a computer-readable medium storing instructionswhich, when executed by the processor, cause the processor to performoperations, the operations comprising: detecting an emergency eventassociated with a first location, wherein the emergency event isdetected via an alert from a device of a responsible agency; deploying afirst virtual network function on a first host device of the wirelessnetwork in a first zone associated with the first location, in responseto the detecting the emergency event, wherein the first zone comprisesan irregular shaped zone; configuring a first alarm threshold for thefirst virtual network function that is indicative of a type of loadingcondition at the first virtual network function; deploying a secondvirtual network function on a second host device of the wireless networkin a second zone, in response to the detecting the emergency event; andconfiguring a second alarm threshold for the second virtual networkfunction that is indicative of the type of loading condition at thesecond virtual network function, wherein the first alarm threshold isless than the second alarm threshold.